Npcpy
Monthly
Improper input validation in the MLX provider of NPC-Worldwide npcpy through version 2.1.27 allows a remote attacker to influence the 'model' argument passed to get_mlx_response in npcpy/gen/response.py, producing limited confidentiality, integrity and availability impact (CVSS 4.0 base 5.3, E:P). The vulnerable path is only reachable in deployments that actually use the MLX provider - realistically Apple-silicon/macOS hosts - and where the application lets externally influenced data reach the 'model' parameter; the assessed vector requires passive user interaction (UI:P) and no privileges (PR:N). No CISA KEV entry exists, but a public proof-of-concept reference has been published alongside the VulDB entry and a GitHub issue; that reference is not verified as working exploit code, and the precise trigger and resulting failure mode are not described in the available sources.
Code injection in NPC-Worldwide's npcpy library (versions up to and including 2.1.27) allows an attacker who can influence the base_model_name_or_path argument of load_sft_model in npcpy/ft/sft.py to execute injected code during supervised fine-tuning model loading, with the assessed impact rated high for confidentiality, integrity and availability. The CVSS 4.0 vector supplied by the reporter carries PR:N but UI:P, so the flaw is unauthenticated in the sense that no credentials are required, yet some user or application action (initiating the model load with the crafted value) is needed; the independent assessment is that real exposure depends entirely on whether a deploying application passes untrusted input into this parameter, and a public PoC reference exists but is not verified as working exploit code. There is no KEV listing and the current decision label is monitor, so this is a low real-world priority despite the RCE/code-injection framing.
Improper input validation in the MLX provider of NPC-Worldwide npcpy through version 2.1.27 allows a remote attacker to influence the 'model' argument passed to get_mlx_response in npcpy/gen/response.py, producing limited confidentiality, integrity and availability impact (CVSS 4.0 base 5.3, E:P). The vulnerable path is only reachable in deployments that actually use the MLX provider - realistically Apple-silicon/macOS hosts - and where the application lets externally influenced data reach the 'model' parameter; the assessed vector requires passive user interaction (UI:P) and no privileges (PR:N). No CISA KEV entry exists, but a public proof-of-concept reference has been published alongside the VulDB entry and a GitHub issue; that reference is not verified as working exploit code, and the precise trigger and resulting failure mode are not described in the available sources.
Code injection in NPC-Worldwide's npcpy library (versions up to and including 2.1.27) allows an attacker who can influence the base_model_name_or_path argument of load_sft_model in npcpy/ft/sft.py to execute injected code during supervised fine-tuning model loading, with the assessed impact rated high for confidentiality, integrity and availability. The CVSS 4.0 vector supplied by the reporter carries PR:N but UI:P, so the flaw is unauthenticated in the sense that no credentials are required, yet some user or application action (initiating the model load with the crafted value) is needed; the independent assessment is that real exposure depends entirely on whether a deploying application passes untrusted input into this parameter, and a public PoC reference exists but is not verified as working exploit code. There is no KEV listing and the current decision label is monitor, so this is a low real-world priority despite the RCE/code-injection framing.